{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7826", "assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "state": "PUBLISHED", "assignerShortName": "securin", "dateReserved": "2026-05-05T02:50:40.051Z", "datePublished": "2026-10-09T04:04:30.130Z", "dateUpdated": "2026-10-09T04:04:30.130Z"}, "containers": {"cna": {"title": "Heap out-of-bounds read in FalkorDB BufferSerializerIOv2_ReadBuffer via crafted RDB", "descriptions": [{"lang": "en", "value": "A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or disclose heap memory by supplying a crafted RDB stream whose sub-buffer length field exceeds the remaining buffer size. The only bounds check is an ASSERT(), which is compiled out in release builds, so memcpy() reads past the end of the heap allocation."}], "affected": [{"vendor": "FalkorDB", "product": "FalkorDB", "collectionURL": "https://github.com/FalkorDB/FalkorDB", "repo": "https://github.com/FalkorDB/FalkorDB", "modules": ["RDB serializer / graph decoder"], "programFiles": ["src/serializers/serializer_io.c"], "programRoutines": [{"name": "BufferSerializerIOv2_ReadBuffer"}], "cpes": ["cpe:2.3:a:falkordb:falkordb:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "4.18.4", "status": "affected", "versionType": "semver"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N", "baseScore": 8.8, "baseSeverity": "HIGH"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL"}}], "solutions": [{"lang": "en", "value": "Upgrade FalkorDB to version 4.18.4 or later."}], "workarounds": [{"lang": "en", "value": "Require authentication on the Redis/FalkorDB instance (requirepass or ACLs), restrict or rename the REPLICAOF/SLAVEOF commands so untrusted clients cannot use them, and do not expose the instance to untrusted networks."}], "references": [{"url": "https://github.com/FalkorDB/FalkorDB/pull/1972", "name": "FalkorDB PR #1972", "tags": ["patch"]}, {"url": "https://github.com/FalkorDB/FalkorDB/commit/55d986f45ecd5d80f7a9e5e138e8b0f96535b48c", "name": "Fix commit", "tags": ["patch"]}, {"url": "https://github.com/FalkorDB/FalkorDB/releases/tag/v4.18.4", "name": "FalkorDB 4.18.4 release notes", "tags": ["release-notes"]}], "credits": [{"lang": "en", "type": "finder", "value": "Arjun Basnet from Securin"}], "timeline": [{"time": "2026-04-24T00:00:00.000Z", "lang": "en", "value": "Reported to FalkorDB"}, {"time": "2026-05-05T00:00:00.000Z", "lang": "en", "value": "CVE ID shared with the vendor"}, {"time": "2026-05-07T00:00:00.000Z", "lang": "en", "value": "Fix merged by the vendor (PR #1972)"}, {"time": "2026-05-07T00:00:00.000Z", "lang": "en", "value": "FalkorDB 4.18.4 released with the fix"}], "source": {"discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-540", "descriptions": [{"lang": "en", "value": "CAPEC-540 Overread Buffers"}]}], "providerMetadata": {"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "shortName": "securin", "dateUpdated": "2026-10-09T04:04:30.130Z"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/FalkorDB/FalkorDB", "cpes": ["cpe:2.3:a:falkordb:falkordb:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["RDB serializer / graph decoder"], "product": "FalkorDB", "programFiles": ["src/serializers/serializer_io.c"], "programRoutines": [{"name": "BufferSerializerIOv2_ReadBuffer"}], "repo": "https://github.com/FalkorDB/FalkorDB", "vendor": "FalkorDB", "versions": [{"lessThan": "4.18.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or disclose heap memory by supplying a crafted RDB stream whose sub-buffer length field exceeds the remaining buffer size. The only bounds check is an ASSERT(), which is compiled out in release builds, so memcpy() reads past the end of the heap allocation."}], "id": "CVE-2026-7826", "lastModified": "2026-10-09T05:16:45.270", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "type": "Secondary"}]}, "published": "2026-10-09T05:16:45.150", "references": [{"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "url": "https://github.com/FalkorDB/FalkorDB/commit/55d986f45ecd5d80f7a9e5e138e8b0f96535b48c"}, {"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "url": "https://github.com/FalkorDB/FalkorDB/pull/1972"}, {"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "url": "https://github.com/FalkorDB/FalkorDB/releases/tag/v4.18.4"}], "sourceIdentifier": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.18.4)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "FalkorDB", "source": "cna", "vendor": "FalkorDB"}, "product": "falkordb", "vendor": "falkordb"}], "created": "2026-10-09T05:30:08.139381+00:00", "updated": "2026-10-09T05:30:08.765297+00:00", "vendors": ["falkordb", "falkordb$PRODUCT$falkordb"]}